Security
What data we hold, and how far AI may act.
- Aligned with Indonesia’s PDP Law No. 27/2022
- AI limits written first
- No certification claims
Your data
Legal basis
we process personal data under Indonesia’s Law No. 27 of 2022 on Personal Data Protection.
Only what is needed
we collect only what is needed to answer your enquiry and to carry out agreed work.
Encryption
data is encrypted in transit.
Who can open it
access is limited to the people who need it.
Third parties
only service providers that help us run the business, contractually bound to protect the data.
For client work
storage location, retention period and deletion procedure are agreed in writing before the engagement begins.
AI may only work inside limits we write down first.
These six are written down before the AI runs, not after something goes wrong.
Scope
what work it may do, and what falls outside it.
Data access
which sources it may read. No access is granted without a written reason.
Actions
what it may do without human approval, and what it may not.
Review point
at which step the accountable person checks before the result moves on.
Outside the limits
what happens when the AI meets a case outside its boundary.
Trail
what is recorded so decisions can be reviewed later.
What we do not have
We do not hold third-party security certifications such as ISO 27001 or SOC 2, and we do not claim otherwise. We also do not promise Indonesian data residency as standard. If that is a requirement, say so early and we will agree it in writing before work begins.
Is there a security requirement that has to be met first?
Mention it at the start, so we know as early as possible whether the work can go ahead.